package tc.alert.tckejisoc.wx;

import lombok.extern.slf4j.Slf4j;
import tc.alert.tckejisoc.dto.EdrDTO;

import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;

@Slf4j
public class WeChatRobot {


    // 企业微信Webhook地址
    private static final String WEBHOOK_URL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=04b3e891-4fcf-4caf-bd39-73b0d41a0b22";

    public static void sendEdrMessage(EdrDTO dto) {

        KvMarkdownMessage message = new KvMarkdownMessage(WEBHOOK_URL)
                .setTitle("测试环境-EDR")
                .addField("索引名称", dto.getIndex())
                .addField("索引id", dto.getId())
                .addField("事件名称", dto.getEventName())
                .addField("事件内容", dto.getEventContent())
                .addField("事件级别", dto.getEventLevel())
                .addField("事件时间", "2023-07-07 12:00:00")
                .useTableStyle(false);
        try {
            message.send();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static void sendHrMessage(EdrDTO dto) {

        // 1. 解析原始时间（带时区）
        ZonedDateTime originalTime = ZonedDateTime.parse(dto.getDataTime());

        // 2. 转换为UTC时间
        ZonedDateTime utcTime = originalTime.withZoneSameInstant(ZoneId.of("UTC"));

        // 3. 定义目标格式（不带时区标识）
        DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss");

        // 4. 格式化输出
        String formattedTime = utcTime.format(formatter);
        KvMarkdownMessage message = new KvMarkdownMessage(WEBHOOK_URL)
                .setTitle("测试环境-火绒")
                .addField("索引名称", dto.getIndex())
                .addField("索引id", dto.getId())
                .addField("事件类型", dto.getEventName())
                .addField("mac地址", dto.getMac())
                .addField("本地IP", dto.getSrcIp())
                .addField("通信IP", dto.getDestIp())
                .addField("事件时间", utcTime.format(formatter))
                .useTableStyle(false);
        try {
            message.send();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static void sendWafMessage(EdrDTO dto) {

        KvMarkdownMessage message = new KvMarkdownMessage(WEBHOOK_URL)
                .setTitle("测试环境-WAF")
                .addField("索引名称", dto.getIndex())
                .addField("索引event_id", dto.getId())
                .addField("事件名称", dto.getEventName())
                .addField("攻击ip", dto.getSrcIp())
                .addField("目的ip", dto.getDestIp())
//                .addField("事件内容", dto.getEventContent())
                .addField("事件级别", dto.getEventLevel())
                .addField("事件时间", dto.getTimestampHuman())
                .addField("处理动作", dto.getAction())
                .useTableStyle(false);
        try {
            message.send();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static void sendTyMessage(EdrDTO dto) {

        KvMarkdownMessage message = new KvMarkdownMessage(WEBHOOK_URL)
                .setTitle("测试环境-天眼")
                .addField("索引名称", dto.getIndex())
                .addField("索引id", dto.getId())
                .addField("攻击ip", dto.getSrcIp())
                .addField("目的ip", dto.getDestIp())
                .addField("事件名称", dto.getEventName())
                .addField("事件名称", dto.getEventContent())
                .addField("事件时间", dto.getDataTime())
                .useTableStyle(false);
        try {
            message.send();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

}
